System and method for analyzing user-generated event information and message information from network devices

ABSTRACT

A system for analyzing information relating to network devices comprises a computer readable storage medium and computer software stored on the computer readable storage medium. The computer software reviews message information generated by a plurality of network devices, stores first event records associating first events from the message information with the plurality of the network devices, reviews user-reported event information, correlate the user-reported event information with a network device, store a second event record associating a second event from the user-reported event information with the network device correlated with the user-reported event information, calculate a total value for on ones of the network devices, and generates a report according to the total values.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is related to U.S. application Ser. No. 10/973,085,filed on Oct. 25, 2004, by Richard W. Korzeniowski and entitled “Systemand Method for Analyzing Information Relating to Network Devices.”

This application is related to U.S. application Ser. No. 10/972,975,filed on Oct. 25, 2004, by Richard W. Korzeniowski and entitled “Systemand Method for Analyzing Message Information From Diverse NetworkDevices.”

TECHNICAL FIELD OF THE INVENTION

This invention relates to the field of information analysis and, morespecifically, to a system and method for analyzing user-generated eventinformation and message information from network devices.

BACKGROUND OF THE INVENTION

Data networks may include file servers, print servers, routers,switches, client computers, hubs, or other network devices. As the sizeand complexity of data networks have increased, it has become moredifficult to analyze the status of the various network devices that makeup the data network and to identify problems with the network devicesthat may warrant further investigation by administrators.

SUMMARY OF THE INVENTION

In accordance with the invention, a system and method for analyzinguser-generated event information and message information from networkdevices is provided that substantially eliminates or reducesdisadvantages or problems associated with previously developed systemsand methods.

In one embodiment, a system for analyzing information relating tonetwork devices comprises a computer readable storage medium andcomputer software stored on the computer readable storage medium. Thecomputer software reviews message information generated by a pluralityof network devices, stores first event records associating first eventsfrom the message information with the plurality of the network devices,reviews user-reported event information, correlate the user-reportedevent information with a network device, store a second event recordassociating a second event from the user-reported event information withthe network device correlated with the user-reported event information,calculate a total value for ones of the network devices, and generates areport according to the total values.

The invention provides a number of important technical advantages. Theinvention efficiently and effectively identifies network devices thatmay be experiencing systemic problems and that may warrant furtherinvestigation. The invention can analyze message information sent fromvarious manufacturers' devices and compensate for the fact thatdifferent manufacturers may send the same message more or lessfrequently. The invention may also analyze tickets generated by users.By considering both user and device information, the invention canprovide a more accurate analysis of the operation of the networkdevices. Embodiments of the invention may have none, some, or all ofthese advantages without departing from the scope of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

For a more complete understanding of the present invention and theadvantages thereof, reference is now made to the following descriptionstaken in conjunction with the accompanying drawings in which:

FIG. 1 illustrates a block diagram of a general purpose computer thatmay be used for analyzing information about network devices;

FIG. 2 illustrates a block diagram of one embodiment of a system foranalyzing information relating to network devices;

FIG. 3 illustrates an exemplary table of event records;

FIG. 4 illustrates an exemplary table of network device information;

FIG. 5 illustrates an exemplary table including location information;and

FIG. 6 is a flowchart of an exemplary method for analyzing informationfrom network devices;

DETAILED DESCRIPTION OF THE DRAWINGS

The preferred embodiment of the present invention and its advantages arebest understood by referring to FIGS. 1 through 6 of the drawings, likenumerals being used for like and corresponding parts of the variousdrawings.

FIG. 1 illustrates a block diagram of a general purpose computer 10 thatmay be used for analyzing information relating to network devices.

General purpose computer 10 may be adapted to execute any of the wellknown MS-DOS, PC-DOS, OS2, UNIX, MAC-OS and Windows operating systems orother operating systems. As used in this document, operating system mayrefer to the local operating system for computer 10, a network operatingsystem, or a combination of both. General purpose computer 10 comprisesprocessor 12, random access memory (RAM) 14, read only memory (ROM) 16,mouse 18, keyboard 20, and input/output devices such as printer 24, diskdrives 22, display 26 and communications link 28. The present inventionincludes programs that may be stored in RAM 14, ROM 16, or disk drives22 and may be executed by processor 12. Communications link 28 isconnected to a computer network but could be connected to a telephoneline, an antenna, a gateway, or any other type of communication link.Disk drive 22 may include a variety of types of storage media such as,for example, floppy disk drives, hard disk drives, CD ROM drives,DVD-ROM drives, or magnetic tape drives. Disk drive 22 may also includea network disk housed in a server within the enterprise network.Software for the invention may be stored on one or more storage medialocated on one or more computers. Although this embodiment employs aplurality of disk drives 22, a single disk drive 22 could be usedwithout departing from the scope of the invention. FIG. 1 only providesone example of a computer that may be used with the invention. Theinvention could be used with computers other than general purposecomputers as well as general purpose computers without conventionaloperating systems.

FIG. 2 illustrates a block diagram of a system 100 for analyzinginformation relating to network devices 102 a, 102 b, and 102 c(collectively, network devices 102). System 100 may include filterengine 104, counting engine 106, weighting engine 108, reporting engine110, and correlating engine 112. System 100 may review messageinformation generated by network devices 102 and/or review ticketinformation 114 generated by users. System 100 may also analyze theevents described in the event information and ticket information, andgenerates a device report 116. Other components may be included insystem 100 or some of these components excluded without departing fromthe scope of the invention. In addition, the components of system 100may be arranged in a different manner. The functions performed by system100 may be performed by one computer or multiple computers.

Network devices 102 may include file servers, print servers, routers,switches, client computers, hubs, or any other processing orcommunication device coupled to a data network 118. Network devices 102may generate and communicate messages relating to their status oroperation. In some embodiments, a server may poll one or more networkdevices 102 for such messages if they are not automatically communicatedor if further data may be obtained. These messages may be in differentformats depending on the type of network device 102, the manufacturer ofnetwork device 102, the type of messages, or other factors. Networkdevices 102 may generate and communicate, for example, SysLog messages,RMON messages, SNMP event traps, alarm messages, or any other messagesrelating to the operation or status of network devices 102.

Network devices 102 may generate SysLog messages and communicate theSysLog messages to a SYS LOG server 120, which stores the messages inthe form of a text log. In a particular embodiment, network devices 102may be programmed to send diagnostic or error related messages todesignated SYS LOG servers 120, as identified by their data networkaddress or name. Device manufacturers typically define the scope anddetail of these messages. In a particular embodiment, messages mayinclude a level or grade which identifies the importance of the message.For example, a message assigned a low level may merely includeoperational information, and a message assigned a high level mayindicate a severe system failure. In a particular embodiment, a user maybe able to select the level of messages that network devices 102 send toSysLog server 120 or that SysLog server 120 stores and retains.

Network devices 102 may send RMON messages or traps to an RMON logger122. RMON logger 122 is a server which collects RMON messages andprovides them for review. Network devices 102 may send the RMONmessages, for example, when status or operational information exceeds athreshold defined within network devices 102. For example, in aparticular embodiment, when operational values, such as CPU utilization,are above or below RMON program thresholds, network devices 102 may sendRMON messages and related details to RMON logger 122.

Network devices 102 may send SNMP event traps to an SNMP event server124. SNMP event server 124 expects messages in predefined SNMP formats.Depending on the messaging levels reported, SNMP event server 124 mayindicate network operational status via text or graphical userinterfaces.

Alarm log server 126 may monitor network devices 102 and generate alarmlogs. Alarm log server 126 may receive any combination of SYS LOGmessages, RMON messages or traps, SNMP event traps, or other messagesfrom network devices 102. In addition, in some embodiments, alarm logserver 126 may perform active interrogation of network devices 102 andtheir environment. Alarm log server 126 generates alarm logs which maycontain copies of these messages as well information inferred by alarmlog server 126.

Filter engine 104 may review message information generated by networkdevices 102 and identify events relating to network devices 102 forfurther analysis. In a particular embodiment, filter engine 104 sendsdirect inquiries, such as SQL queries, to databases 130 associated withSYS LOG server 120, RMON logger 122, SNMP event server 124, and alarmlog server 126. In an alternative embodiment, filter engine 104 mayreview text-based reports from SYS LOG server 120, RMON logger 122, SNMPevent server 124, and alarm log server 126.

Filter engine 104 may use various searches or filters to identify eventsrelating to network devices 102 for further analysis. For example, in aparticular embodiment, filter engine 104 may use a table of text stringsto identify significant events for analysis or may use a table of textstrings to identify events which are not significant. Filter engine 104may identify matches to these text strings by using wildcard comparisonsto the body of the message information. In a particular embodiment,filter engine 104 may use any combination of day-of-the-week,time-of-day designations, site-identifiers, device-identifiers, or otherfilters to identify message information that are related to significantevents or to identify message information that may be ignored.

In a particular embodiment, filter engine 104 may filter out and ignoremessages that are insignificant to network performance as determined bythe user of system 100. For example, network devices 102 may generatemessage information that relate to their performance but are notindicative of any problems, such as messages relating to processorusage, memory usage, or other status information. Filter engine 104 mayfilter out these message because they are not useful to identify networkdevices 102 that may have problems that warrant further investigation.Other embodiments may not filter out any messages.

Filter engine 104 stores event records about the events identified fromthe message information. Filter engine 104 may store event records indatabase 130 or any other suitable data storage means. The event recordsmay associate each identified event with network device 102 with whichthe event relates. Network devices 102 may be identified by name,number, data network address, or any other information suitable foridentifying network devices 102. In addition, the event records mayassociate each event with an event type, which is a defined class orgroup of events. The event records may associate each event with asource, which could include any suitable combination of SysLog server120, RMON logger 122, SNMP event server 124, alarm log server 126, orother network devices 102 from which filter engine 104 received messageinformation about the event. The event records may associate each eventwith a time at which the event occurred. The time may include anycombination of year, month, day, hour, minutes, seconds or othersuitable temporal information. The event records may also identify thelocation of network device 102 with which the event relates. Thelocation may includes any combination of country, state, county, city,street address, zip code, building, floor, or other information suitablefor identifying the location of network device 102. Filter engine 104may use arrays, linked lists, pointers, or any other suitable datastructures to store these associations.

Counting engine 106 may normalize the event information by reducingduplicate events. Some network devices 102 may repeat a messageperiodically, resulting in many duplicate messages sent to SysLog server120, RMON logger 122, NSMP event server 124, or alarm log server 126over a period of time. For example, network device 102 may reach atemperature over a particular threshold and send a message relating tothis event to SysLog server 120 once every hour until the condition iscorrected. Based on this message information, filter engine 104 mayidentify duplicate events relating to each of the duplicate messages.These duplicate events may skew any analysis of network devices 102, forexample, by over-weighting the significance of the duplicate events. Tonormalize the event information, counting engine 106 may count duplicateevents within a defined time window as a single event or other number ofevents less than the actual number of duplicate messages.

Counting engine 106 may store time window information regarding a timewindow in which particular messages from particular network devices 102are counted only a single time. In a particular embodiment, countingengine 106 may use a time window of a particular length for all events.In an alternative embodiment, counting engine 106 may use different timewindows depending on any combination of the types of network devices102, the particular network device 102, the types of events, the sourcesof the events, the locations of network devices 102, or any othersuitable criteria. For example, events relating to network device 102 amay be associated with a longer time window than events relating toanother network device 102 b because network devices 102 a and 102 b maybe different types of network device 102. Different devices 102 mayexhibit different behavior, thus justifying different time windows.Alternatively, event types that are less significant, such astemperature events, may be associated with a longer time window thanmore significant event types, such as a catastrophic network outage. Insuch embodiments, the time window information may associate time windowswith network device types, particular network devices 102, event types,sources, locations, or other factors, and counting engine 106 may usethe time window information to identify which time window to apply toparticular duplicate events. For example, counting engine 106 mayidentify one of the time windows to apply to the duplicate events bydetermining an event type of the duplicate events and identifying thetime window associated with that event type according to the time windowinformation stored in database 130. Alternatively, counting engine 106may identify one of the time windows to apply to the duplicate events byidentifying network device 102 associated with the duplicate eventsaccording the event information stored in database 130 and identifying atime window associated with network device 102 according to the storedtime window information.

Counting engine 106 may determine whether two or more duplicate eventsare within a time window and delete the duplicate events within the timewindow. In a particular embodiment, counting engine 106 works togetherwith filter engine 104 to determine which events are included in theevent records stored in database 130. In such an embodiment, filterengine 104 may not store event records for all duplicate events but onlyfor a subset of the duplicate events identified by counting engine 106(and that are to be counted and not filtered out). In an alternativeembodiment, filter engine 104 stores event records for all duplicateevents in database 130, and counting engine 106 may delete some of theevent records to reduce the duplicate events to a smaller number ofevents. In yet another embodiment, counting engine may select a subsetof the event records for further analysis and identify the selectedsubset of event records for further processing by weighting engine 108.

In a particular embodiment, the time window may be a sliding time windowwhich has a beginning and end defined relative to the time of theduplicate events. For example, the time window may begin at the time ofthe earliest event, and counting engine 106 may disregard duplicatemessages received prior to the end of the time window. After the end ofthe time window, counting engine 106 may identify and count the nextduplicate event and begin another time window at the time of thatduplicate event.

In an alternative embodiment, the time window may be a fixed time windowwhich has a beginning and end defined independent of the duplicateevents. For example, the time window may be defined relative to a clock,and each time window may begin at the point where the prior window ends.In such an embodiment, counting engine 106 may determine whether thereare two or more duplicate events within a time window and reduce theduplicate events to a single event by either not counting the additionalduplicate events, deleting the additional duplicative events from theevent information stored in database 130, or by selecting andidentifying the single event for further analysis by weighting engine108.

Weighting engine 108 may receive event information from the eventrecords and assign a value to each event according to the event'srelative importance. Weighting engine 108 may assign a value to eachevent based on any combination of the type of network device 102associated with the event, the type of event, or any other suitablecriteria. For example, in a particular embodiment, weighting engine 108may give a greater value to a more operationally significant event thanto a less operationally significant event. In an alternative embodiment,weighting engine 108 may assign a greater value to events that areassociated with a more operationally significant network device 102 thansimilar events associated with a less operationally significant networkdevices 102. In another particular embodiment, weighting engine 108 mayassign values to events according to the source of the eventinformation. For example, weighting engine 108 may assign events thatwere identified from alarm log server 126 a higher value than eventsthat were identified from SysLog server 120. As would be understood by aperson skilled in the art, a programmer may design weighting engine 108to assign values to events according to any suitable criteria. In aparticular embodiment, users may select or otherwise determine the rulesused by weighting engine 108 to assign values to events.

Weighting engine 108 may use various models to assign values to events.In a particular embodiment, weighting engine 108 may use a straightweighting model in which each event of a particular type is assigned thesame value. Such a straight weighting model may be appropriate where anyoccurrence of an event would be of the same significance regardless ofthe timing or number of events. In an alternative embodiment, weightingengine 108 may use a simple linear model in which recurring events aregiven greater value in a linear fashion. For example, weighting engine108 may assign a given value to a particular event relating to aparticular network device 102, and use a linear scale to assign greatervalues to each subsequent event of the same type relating to the samenetwork device 102. In another alternative embodiment, weighting engine108 may use an exponential model in which weighting engine 108 assignsgreater values to recurring events according to an exponential asopposed to linear scale. Such an exponential model may be appropriatewhere network devices 102 do not send a great deal of messages relatingto a particular event but the event is critical in nature, and thus eachsubsequent event should be given a greater weight.

Weighting engine 108 may also calculate a total value for each networkdevice 102 according to the values assigned to the events. Weightingengine 108 may store network device information associating thecalculated total values with each network device 102 in database 130. Ina particular embodiment, weighting engine 108 may add the valuesassigned to each event associated with network device 102 to calculatethe total value for network device 102.

Weighting engine 108 may also calculate a total value for each site orlocation according to the values assigned to the events. Weightingengine 108 may store location information associating the calculatedtotal values with each location in database 130. In a particularembodiment, to calculate the total value for a location, weightingengine 109 may add the weighted values assigned to each event associatedwith network devices 102 at that location. In an alternative embodiment,to calculate the total value for a location, weighting engine 109 mayadd the total value associated with each network device 102 at thatlocation. Similar values could be calculated for subsets of a locationor for a combination of locations or subsets thereof. For example, avalue could be calculated for those network devices 102 within theresponsibility of a group of information technology (IT) professionals.

Some embodiment may not include the functionality described above withreference to weighting engine 108. Alternatively, weighting engine 108could be implemented in combination with filtering engine 104 and/orcounting engine 106. For example, instead of counting engine 106discarding duplicate events, weighting engine 108 may just assignsmaller values to each duplicate event.

Reporting engine 110 may generate various reports 116 relating tonetwork devices 102. Reporting engine 110 may generate reports 116 basedon particular types of events. For example, reporting engine 110 mayanalyze events relating to the level of activity of network devices 102and generate reports 116 identifying network devices 102 that were mostactive over a given time period. For example, report 116 may be a listof network devices 102 in order from most active to least active. Suchreport 116 may be used to identify network devices 102 that areespecially critical and may warrant special attention.

Reporting engine 110 may produce reports 116 identifying the locationsexperiencing problems that warrant further investigation. Using thelocation information stored in database 130, reporting engine 110 mayidentify the total values associated with the locations (which mayinclude multiple network devices 102) and generate reports 116 accordingto these total values. In a particular embodiment, reporting engine 110may generate report 116 listing locations in order of the total valuesassociated with each location. In an alternative embodiment, reportingengine 110 may identify the locations with associated total values abovea defined threshold and generate report 116 listing those identifiedlocations. With these reports 116, reporting engine 110 may identifylocations that warrant further investigation.

Reporting engine 110 may produce reports 116 identifying particularnetwork devices 102 that are experiencing problems warranting furtherinvestigation. Using the network device information stored in database130, reporting engine 110 may identify the total values associated withnetwork devices 102 and generate reports 116 according to these totalvalues. In a particular embodiment, reporting engine 110 may determinewhether the total value associated with each network device 102 isgreater than a threshold value, and generate report 116 identifyingnetwork devices 102 with total values greater than the threshold. In analternative embodiment, reporting engine 110 may generate report 116listing network devices 102 in order according to the total valuesassociated with each network device 102. Reporting engine 110 mayproduce reports based on historic data over any suitable period of time.In a particular embodiment, weighting engine 108 may analyze eventinformation from database 130 over a long period of time to identifyproblems that are infrequent but may show up repeatedly over a longperiod of time.

Reporting engine 110 may produce report 116 which lists network devices102 that have consistently suffered problems over time as determined bythe network device information stored in database 130. Network devices102 which consistently have repeated problems may have systemic issuesor the problems may have not been effectively resolved. Report 116 mayallow users to determine the effectiveness of employees in resolvingissues with network devices 102. For example, if the number of networkdevices 102 with repeat problems increases over time, it could be anindication that an applied problem resolution process is not effective.On the other hand, a decrease in the number of repeat devices over timecould indicate an effective problem identification and remediationprocess. A chart of the count of repeat devices versus time provides asimple graphic illustration of these conditions.

In some embodiments, system 100 may also include correlating engine 112which processes ticket information generated by users. Correlatingengine 112 may review ticket information 114 generated by users,identify one or more ticket events relating to network devices 102, andstore event records associating each identified ticket event with one ofnetwork devices 102. The ticket events identified by correlating engine112 may include problems with network devices 102 reported by users.Weighting engine 108 and reporting engine 110 then process the eventrecords stored by correlating engine 112 in the same manner as the eventrecords stored by filter engine 104 and counting engine 106.

The invention may make use of a typical ticketing system. As a examplean organization may have a help desk for computer users in theorganization. A user may call the help desk complaining about a problem,such as, for example, slow email service. An IT staff member may logthis complaint into a ticketing system that may store ticket informationabout the complaint, such as, for example, the time of the reporting themalfunction, etc. Such a system may have predefined fields to describethe malfunction, a text narrative field for that purpose, or acombination of both.

Like filter engine 104, correlating engine 112 may store the eventrecords in database 130 or any other suitable data storage means. Theevent records may associate each identified ticket event with networkdevice 102 to which the ticket event relates. Network devices 102 may beidentified by name, number, data network address, or any otherinformation suitable for identifying network devices 102. Where no suchassociated is provided, correlating engine 112 may use information for aticket and information about the network to determine potential networkdevice 102 involved. For example, based on the identity of the user whosubmitted the ticket information, correlating engine 102 may be able toidentify network devices 102 used by that user. In addition, the eventrecords may associate each event with an event type, which is a definedclass or group of events. The event records may associate each ticketevent with a source, which would be the user or the user's computer thatgenerated ticket information 114 from which correlating engine 112identified the event. The event records may associate each ticket eventwith a time at which the user generated ticket information 114. The timemay include any combination of year, month, day, hour, minutes, secondsor other suitable temporal information. The event records may alsoidentify the location of network device 102 to which the ticket eventrelates. The location may includes any combination of country, state,county, city, street address, zip code, building, floor, or otherinformation suitable for identifying the location of network device 102.Like filter engine 104, correlating engine 112 may use arrays, linkedlist, pointers, or any other suitable data structures to store theseassociations.

In a particular embodiment, users may use a software program to reportevents relating to the operation of network devices 102. For example,the users may be able to select an event from predefined optionspresented using a drop down menu or other suitable means. In addition,the software may automatically associate the ticket informationgenerated by the user with one of network devices 102 based on a name,data network address, or other information suitable to identify networkdevice 102. In a particular embodiment, the software automaticallyassociates the users' ticket information with network devices 102 usingInternet Protocol addresses of network devices 102.

In an alternative embodiment, users may manually fill out paper ticketsreporting a problem or other event with one of network devices 102, andthe ticket information may be subsequently entered into database 130 orother memory accessible by correlating engine 112.

Database 130 may include network configuration information thatcorrelating engine 112 may use in storing event records. Correlatingengine 112 may identify one of network devices 102 related to a ticketevent, retrieve network configuration information related to identifiednetwork device 102, and associate that network configuration informationwith the ticket event in the event records stored in database 130.Database 130 may include several different databases. For example, in aparticular embodiment, one database 130 may store the networkconfiguration information, and another database 130 may store the eventrecords.

Weighting engine 108 and reporting engine 110 may process the eventrecords stored by correlating engine 112 in the same manner as the eventrecords stored by filter engine 104 and counting engine 106. In aparticular embodiment, weighting engine 108 may assign ticket events ahigher value when they are linked to other events from network devices102.

By taking into account ticket events, system 100 may generate reportthat provide more information about network device 102. For example, theticket event may amplify the importance of other events identified inmessage information from network devices 102. In addition, the ticketevents may identify problems that are not reflected in the messageinformation generated by network devices 102. As a result, system 100may provide a more complete and more accurate analysis of networkdevices 102 by also taking into account ticket events generated byusers.

FIG. 3 is an exemplary table 200 of event records. System 100 may storeevent records in database 130 or other suitable data storage means usingarrays, linked lists, pointers, or any other suitable data structures.Filter engine 104 and counting engine 106 may stores event records fromnetwork devices 102. Correlating engine 112 may store and/or analyzeevent records derived from ticket information 114 generated by users.Using the event records, weighting engine 108 and/or reporting engine110 may analyze network devices 102 and generate reports relating tonetwork devices 102.

Column 202 identifies events relating to the operation of networkdevices 102. Although the event identifiers in column 202 are numbers,system 100 may use any combination of names, addresses, or othersuitable information to identify the events.

Column 204 associates an event in column 202 with one or more of networkdevices 102. System 100 may use any combination of names, data networkaddresses, or other suitable information to identify network devices102. In the illustrated embodiment, column 204 includes an InternetProtocol address (0.1.2.3) to identify a router, and a name (PrintServer #4) to identify a print server.

Column 206 associates an event in column 202 with an event type. Anevent type may include any information relating to the operation ofnetwork device 102 identified in column 204. For example, in theillustrated embodiment, column 206 includes high temperature, equipmentmalfunction, and loss of communication as event types.

Column 208 associates an event identified in column 202 with the sourceof the information relating to that event. If the event informationoriginated from message information generated by network devices 102,the source identified in column 208 may be SYS LOG server 120, RMONlogger 122, SNMP event server 124, or alarm log server 126. If the eventinformation originated from ticket information 114 generated by users,the source in column 208 may identify the particular user or the user'scomputer that generated ticket information 114.

Column 210 associates an event identified in column 202 with the time atwhich the event was recorded. The time may include any combination ofyear, month, day, hour, minutes, seconds or other suitable temporalinformation. The time identified in column 202 may be a time stampgenerated by SYS LOG server 120, RMON logger 122, SNMP event server 124,or alarm log server 126. If the event information originated from ticketinformation 114 generated by a user, the time identified in column 210may be a date or a time identified by the user of the occurrence or whenthe ticket was prepared.

Column 212 identifies a location that includes network device 102identified in column 204 and which is associated with the eventidentified in column 202. The location may include any combination ofcountry, state, city, street address, zip code, building, floor, orother suitable information to identify a location of one or more networkdevices 102. The location may be the physical location of the networkdevice or the location of users served by the device.

Column 214 indicates the value that weighting engine 108 assigns to anevent identified in column 202. As illustrated in table 200, weightingengine 108 may not assign a value to duplicate events within a timewindow. In the illustrated embodiment, the events listed in rows 218,220, and 222 are not assigned a value because they fall within the sametime window as the event listed in row 216. As explained above,weighting engine 108 may increase the value assigned to an event of aparticular event type. For example, in the illustrated embodiment, thehigh temperature event in row 216 is assigned a value of 1, and thesubsequent high temperature event associated with the same networkdevice 102 in row 224 is assigned the value of 2.

FIG. 4 illustrates a table 300 of network device information generatedby weighting engine 108. As described above, weighting engine 108 maycalculate a total value for each network device 102 using the valuesassigned to each event identified in the event records stored in table200 and store network device information associated by the calculatedtotal value with network devices 102. Reporting engine 110 uses thenetwork device information to generate reports relating to networkdevices 102. Normally, the total values will reflect the total valuewithin a particular time frame.

Column 302 identifies network devices 102. Column 302 may include anycombination of data network addresses, names, numbers, or other suitableinformation to identify network devices 102.

Column 304 associates network devices 102 identified in column 302 witha total value. As described above, weighting engine 108 calculates atotal value for network devices 102 using the values assigned to theevents associated with network device 102. In a particular embodiment,weighting engine 108 adds the values assigned to the events related tonetwork device 102 to arrive at a total value for network device 102.Using column 304, weighting engine may associate the calculated totalvalues with network devices 102 in column 302. Using the total values incolumn 304, reporting engine 110 may generate reports 116 relating toassociated network device 102 in column 302. In a particular embodiment,reporting engine 110 lists network devices 102 in order according to thetotal value in column 304 associated with each network device 102 incolumn 302. In an alternative embodiment, reporting engine 110 mayidentify a subset of network devices 102 in column 302 that areassociated with a total value in column 304 above a defined threshold.In some embodiments, weighting engine 108 may add up separate totals fordifferent classes of events associated with particular network devices102.

FIG. 5 is a table 400 including location information. Weighting engine108 may calculate a total value for each location and may store locationinformation associating the calculated total values with the locations.Reporting engine 110 may use the location information to generate report116 relating to network devices 102.

Column 402 identifies locations including network devices 102. Thelocations identified in column 402 may include any combination ofcountry, state, county, city, street address, building, floor, or othersuitable information to identify locations including network devices102. Also, the location could be a set of network resources assigned toparticular IT staff.

Column 404 associates a total value with the locations identified incolumn 402 and stores the calculated total values in column 404.Weighting engine 108 may calculate a total value for each location incolumn 402. In a particular embodiment, to calculate a total value for alocation weighting engine 108 identifies network devices 102 associatedwith the location and adds the total value associated with eachidentified network device 102 in table 300. Reporting engine 110generates a report relating to network devices 102 using the locationinformation in table 400. In a particular embodiment, reporting engine110 generates a list of locations in column 402 in order according tothe total values in column 404. In an alternative embodiment, reportingengine 110 may identify the locations in column 402 associated withtotal values in column 404 above a defined threshold.

FIG. 6 is a flow chart of a method of analyzing event information aboutnetwork devices 102. The method begins at step 602, where filter engine104 reviews message information generated by network devices 102. Atstep 604, filter engine 104 identifies an event relating to theoperation of one of network devices 102. At step 606, counting engine106 determines whether the identified event duplicates another eventwithin a time window. If counting engine 106 determines that theidentified event is not a duplicate of another event within a timewindow at step 606, counting engine 106 stores an event recordassociating the identified event with network device 102, and the methodcontinues at step 609. In an alternative embodiment, filter engine 104may store event records for all identified events, and counting engine106 may delete duplicate events (or simply not count them) from theevent records stored in database 130 or select and identify a subset ofthe duplicate event for further analysis by weighting engine 108. Ifcounting engine 106 determines that the identified event is a duplicateof another event within a time window at step 606, the method continuesat step 609. In some embodiments, steps 602-609 may be omitted.

At step 609, filter engine 104 determines whether it has identified allevents in the message information (normally within a particular timewindow). If filter engine 104 has not identified all events, the methodreturns to step 604; otherwise, the method continues to step 610.

At step 610, correlating engine 112 reviews ticket information generatedby users. Correlating engine 112 identifies an event relating to theoperation of one of network devices 102 from the ticket information atstep 612, and correlating engine 112 stores an event record associatingthe identified event with network device 102 at step 614. In someembodiments, steps 610-615 maybe omitted.

At step 615, correlating engine 112 determines whether it has identifiedall events in the ticket information. If correlating engine 112 has notidentified all events, the method returns to step 612; otherwise, themethod continues to step 616.

At step 616, weighting engine 108 reviews the event records stored indatabase 130. At step 618, weighting engine 108 assigns a value to eachof the events associated with network devices 102. As described above,weighting engine 108 may assign the values according any combination ofsuitable factors and using any suitable models. Weighting engine 108calculates a total value for each network device 102 at step 620 (or aplurality of total values based upon classes of events) and storesnetwork device information associating each network device 102 with thecalculated total value at step 622. In a particular embodiment,weighting engine 108 stores the network device information using a table300. Weighting engine 108 calculates a total value for each location atstep 624 and stores location information associating each location withits total calculated value at step 626. In a particular embodiment,weighting engine 108 stores the location information using a table 400.In some embodiments, steps 616-626 may be omitted. In other embodiments,weights may all be the same and will not vary based upon variouscharacteristics of an event or groups of events.

At step 628, reporting engine 110 generates reports 116 using thenetwork device information and location information stored in database130. In a particular embodiment, reporting engine 110 may generatereport 116 listing network devices 102 in order of the total valueassociated with each network device 102. In an alternative embodiment,reporting engine 110 may generate report 116 identifying network devices102 associated with a total value greater than a defined threshold. Inan alternative embodiment, reporting engine 110 may generate report 116listing locations in order according to the total value associated witheach location. In an alternative embodiment, reporting engine 110 maygenerate report 116 identifying locations associated with a total valuegreater than a defined threshold. Other reports may also be generatedwithout departing from the scope of the invention.

Reporting engine 110 may also generate emails, alarms, or othernotifications to identify network devices 102 or locations that warrantfurther investigation. In a particular embodiment, reporting engine 110determines whether a total value associated with network device 102 isgreater than a defined threshold and generates a notification toinvestigate network device 102 in response to determining that the totalvalue associated with network device 102 is greater than the definedthreshold.

Although embodiments of the invention and advantages are described indetail, a person skilled in the art could make various alterations,additions, and omissions without departing from the spirit and scope ofthe present invention as defined by the appended claims.

To aid the patent office, and any readers of any patent issued on thisapplication in interpreting the claims appended hereto, applicants wishto note that they do not intend any of the appended claims to invokeparagraph 6 of 35 U.S.C. § 112 as it exists on the date of filing hereofunless “means for” or “step for” are used in the particular claim.

1. A system for analyzing information relating to network devices,comprising: a computer readable storage medium; computer software storedon the computer readable storage medium and operable to: review messageinformation generated by a plurality of network devices; store firstevent records associating first events from the message information withthe plurality of the network devices; review user-reported eventinformation; correlate the user-reported event information with anetwork device; store a second event record associating a second eventfrom the user-reported event information with the network devicecorrelated with the user-reported event information; calculate a totalvalue for ones of the network devices; and generate a report accordingto the total values.
 2. The system of claim 1, wherein the user-reportedevent information comprises a textual description of a problem.
 3. Thesystem of claim 1, wherein the user-reported event information comprisesone of a plurality of predefined problem options.
 4. The system of claim1, wherein the user-reported event information associates a reportedevent with a data network address and the software uses the data networkaddress to correlate the user-reported event information with thenetwork device.
 5. The system of claim 1, wherein the software isfurther operable to: retrieve device information about the networkdevice correlated with the user-reported event information; andassociate the device information with the second event in the secondevent record.
 6. The system of claim 1, wherein the software is furtheroperable to: assign a weight value to at least some of the first eventsand the second event; and calculate the total value for ones of thenetwork device using the weighting values.
 7. The system of claim 6,wherein the software is further operable to assign a greater value tothe second event if the network device associated with the second eventis also associated with a first event.
 8. The system of claim 6, whereinthe software is further operable to assign a greater value to one of thefirst events if a network device associated with the first event is alsoassociated with the second event.
 9. The system of claim 1, wherein thesecond event may be associated with more than one network device basedon the user-reported event information.
 10. The system of claim 1,wherein the software is further operable to generate an alert if a totalvalue associated with one of the network devices is greater than athreshold value.
 11. A method for analyzing information relating tonetwork devices, comprising: reviewing message information generated bya plurality of network devices; storing first event records associatingfirst events from the message information with the plurality of thenetwork devices; reviewing user-reported event information; correlatingthe user-reported event information with a network device; storing asecond event record associating a second event from the user-reportedevent information with the network device correlated with theuser-reported event information; calculating a total value for ones ofthe network devices; and generating a report according to the totalvalues.
 12. The method of claim 11, wherein the user-reported eventinformation comprises a textual description of a problem.
 13. The methodof claim 11, wherein the user-reported event information comprises oneof a plurality of predefined problem options.
 14. The method of claim11, wherein the user-reported event information associates a reportedevent with a data network address and the method further comprises usingthe data network address to correlate the user-reported eventinformation with the network device.
 15. The method of claim 11, furthercomprising: retrieving device information about the network devicecorrelated with the user-reported event information; and associating thedevice information with the second event in the second event record. 16.The method of claim 11, further comprising: assigning a weight value toat least some of the first events and the second event; and calculatingthe total value for ones of the network device using the weightingvalues.
 17. The method of claim 16, further comprising assigning agreater value to the second event if the network device associated withthe second event is also associated with a first event.
 18. The methodof claim 16, further comprising assigning a greater value to one of thefirst events if a network device associated with the first event is alsoassociated with the second event.
 19. The method of claim 11, whereinthe second event may be associated with more than one network devicebased on the user-reported event information.
 20. The method of claim11, further comprising generating an alert if a total value associatedwith one of the network devices is greater than a threshold value.